Baselining of data collector data

ABSTRACT

A network management node monitors network attributes of a network. The network management node is connected to network devices through the network and receives data values associated with measured network attributes from said network devices. The data values are stored in the network management node and a baseline value and rearm baseline value for a network attribute are calculated from a plurality of the received data values measured during a first period of time (e.g., a first time bucket). These data values are compared to the baseline value, and an alarm is generated in response to at least one of these data values exceeding the baseline value. The alarm is reset if at least one subsequently measured data value is below the rearm baseline value. The baseline value and rearm baseline value are recalculated from received data values measured during subsequent time buckets. Data values measured during the subsequent time buckets are compared to corresponding baseline and rearm baseline values.

FIELD OF THE INVENTION

[0001] The present invention is generally related to management of acomputer network. More particularly, the present invention is related toimproving the accuracy in the analysis of data collected from remotedevices connected to the network.

BACKGROUND OF THE INVENTION

[0002] Network communications have become a fundamental part of today'scomputing. As networks grow larger, increasingly complex, and interfacewith a variety of diverse networks, the task of monitoring andmaintaining a network also becomes increasingly complex.

[0003] To assist a network manager, network management software (“NMS”)may be used in the management of a network. A conventional NMS maytypically be executed on a management device or node of the network.From the management node, the conventional NMS may be configured todetermine a network topology, detect malfunctioning remote networkdevices or communication links, monitor network traffic, and the like.

[0004] As part of the monitoring duties, the network manager mayconfigure the NMS to occasionally query or poll remote network devicesfor information. The information may include status data, portinformation, address, and the like. The information required may becrucial for the network manager to assess the overall status of thenetwork.

[0005]FIG. 5 illustrates a block diagram of a conventional managementnode or device 500 implementing a conventional data collection from aremote node. In particular, the management node 500 includes a NMS 510and a network interface 520. The NMS 510 may be configured to providethe functionality for a network manager to manage a network 515 throughthe network interface 520.

[0006] The NMS 510 may include a data collector module 530 configured toretrieve user specified information at a scheduled time from remotedevices 525 a . . . 525 n over the network 515, i.e., a data collectionevent. The data collector module 530 may retrieve the selectedinformation from at least one of the remote device 525 a . . . 525 n andstore the selected information in an associated output file in themanagement node 500. The associated output file may be analyzed byadditional network tools of the NMS 510 to assist in the assessment ofthe status and maintenance of the network 515.

[0007] The results of an analysis of the associated output file may beskewed. Typically, network systems experience regular patterns ofnetwork traffic (i.e., data/command packets traversing a network). Atypical pattern may be a high volume of network traffic during themorning hours of a work week resulting from, for example, users checkingtheir electronic mail in the morning), followed by a steady volume ofnetwork traffic for the rest of the day. The network traffic volume maysubsequently drop during the evening hours as users end their respectivework days.

[0008] Network traffic pattern on working days of a week may be markedlydifferent than on a weekend. Weekend activity may include occasionalnetwork administration traffic (e.g., back-up, maintenance commands,etc.) along with an occasional weekend user. The weekend network trafficpattern may also be markedly different from overnight traffic patternduring the working days of a week. This overnight activity may consistentirely of network administration traffic and/or time-intensivecomputations.

[0009] If the results of the analysis of the associated output file areused to determine a performance threshold for incoming data, theperformance threshold computation may be skewed. For a typicalperformance threshold computation, most conventional network managementsystems use all the relevant collected data value points to calculate agiven performance threshold. As a result, the given performancethreshold may not take into account the varying network traffic patternsthat may occur during a week or during a given time period. Accordingly,a weekend data point, which may not be an aberration when compared withcomparable weekend data points, may be an aberration when compared withthe combined data points.

[0010] The aberrations may generate unnecessary alarms (or alerts) to anetwork manager, and the unnecessary alarms may present an erroneouspicture of the state of a network. As a result, a network manager mayunnecessarily adjust performance parameters of the network toaccommodate the unnecessary alarms, which may lead to an inefficientallocation of network resources. Additionally, the generation ofunnecessary alarms may lead a network manager to assume that all alarmsfrom the NMS are trivial. Thus, the network manager may ignoremeaningful alarms that arrive from the NMS.

[0011] One solution to the generation of unnecessary alarms is aproposal where a sliding window of time is utilized to create theappropriate thresholds. The technique is fully described by U.S. Pat.No. 6,182,022 to Mayle et al., the subject matter of which is hereinincorporated by reference.

[0012] In the Mayle technique, a subset of data points collected duringa sliding window of time T1 (e.g., a week or a month) are used by astatistical analyzer to calculate a baseline for a monitored performanceparameter or attribute. The subset of data points may be collectedduring a period of time within time T1, such as during normal businesshours of a week or a month. The baseline is calculated based on thesubset of data points and represents a normal operating range for themonitored performance parameter during the sliding window of time. Thebaseline is subsequently utilized to generate a new performancethreshold. However, although the sliding window of time may take intoaccount the varying amount of network traffic over an extended period oftime, the technique does not account for performance parameters that mayvary from a calculated threshold in a limited period of time.Furthermore, conventional techniques, including the Mayle technique, donot disclose a method for resetting an alarm.

SUMMARY OF THE INVENTION

[0013] The invention facilitates improved computer network monitoring.In one respect, an exemplary embodiment of the present inventionincludes a method of monitoring network attributes. The method includes:receiving a first plurality of data values for a network attribute;generating an alarm in response to at least one data value of the firstplurality of data values exceeding a first threshold for the networkattribute; and resetting the alarm in response to a data value notexceeding a second threshold for the network attribute. The secondthreshold is within the first threshold (e.g., below the first thresholdor within a range of the first threshold), and the data value is a datavalue that was measured subsequent to the at least one data value thatcaused the alarm to be generated. The method further includes steps ofcalculating the first threshold based on the first plurality of datavalues, wherein the first plurality of data values are measured during afirst predetermined period of time; and comparing the first plurality ofdata values to the first threshold. The method further includes steps ofrecalculating the first threshold based on a second plurality ofreceived data values measured during a second predetermined period oftime, subsequent the first period of time; comparing the secondplurality of data values to the recalculated first threshold; andgenerating a second alarm after the alarm is reset in response to atleast one of the second plurality of data values exceeding therecalculated first threshold. The first predetermined period of time andthe second predetermined period of time may approximately be one hourtime intervals. Also, the first and second thresholds and subsequentlyrecalculated thresholds may include a single value or a range of values.

[0014] Exemplary methods of the present invention include steps that maybe performed by computer-executable instructions executing on acomputer-readable medium.

[0015] In another respect, an exemplary embodiment of the presentinvention includes an apparatus operable to monitor a plurality ofnetwork attributes. The apparatus includes a data collector configuredto receive a first plurality of data values for a network attribute froma plurality of network devices via a network; a threshold calculatorconfigured to calculate a first threshold for the network attribute anda second threshold for the network attribute from the first plurality ofdata values, the second threshold being within the first threshold; anda threshold comparator configured to compare the first plurality of datavalues to the first threshold and generate an alarm signal in responseto at least one of the first plurality of data values exceeding thefirst threshold. The threshold comparator is further configured togenerate a reset signal after the alarm signal is generated in responseto a data value not exceeding a second threshold for the networkattribute.

[0016] In comparison to known prior art, certain embodiments of thepresent invention are capable of achieving certain advantages, includingsome or all of the following: (1) data collection configuration can beeasily customized; (2) automatic alarm resetting is provided; and (3)accurate alarm event detection is provided using data values measuredduring a limited period of time. Those skilled in the art willappreciate these and other advantages and benefits of variousembodiments of the invention upon reading the following detaileddescription of a preferred embodiment with reference to the below-listeddrawings.

BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The present invention is illustrated by way of example and notlimitation in the accompanying figures in which like numeral referencesrefer to like elements, and wherein:

[0018]FIG. 1 illustrates a block diagram of a network where an exemplaryembodiment of the present invention may be practiced;

[0019]FIG. 2 illustrates a more detailed block diagram of an exemplarymanagement node employing the principles of the present invention;

[0020]FIG. 3 illustrates a detailed block diagram of an exemplarytime-bucketing data collector shown in FIG. 2, according to theprinciples of the present invention;

[0021]FIG. 4 illustrates an exemplary flow diagram of a method employingthe principles of the present invention; and

[0022]FIG. 5 illustrates a block diagram of a conventional managementnode or device implementing a conventional data collection techniquefrom a remote node.

DETAILED DESCRIPTION OF THE INVENTION

[0023] In the following detailed description, numerous specific detailsare set forth in order to provide a thorough understanding of thepresent invention. However, it will be apparent to one of ordinary skillin the art that these specific details need not be used to practice thepresent invention. In other instances, well known structures,interfaces, and processes have not been shown in detail in order not tounnecessarily obscure the present invention.

[0024]FIG. 1 illustrates a block diagram of a network 100 where anexemplary embodiment of the present invention may be practiced. Inparticular, the network 100 includes a management node 110 interfacedwith remote network devices 120 a . . . 120 n via network 140 andmanaged by a NMS 130. The management node 110 may be configured toprovide network management services to the remote network devices 120 a. . . 120 n through the network 140. The management node 110 may providethe capability of monitoring, troubleshooting, and/or diagnosing of theremote network devices 120 a . . . 120 n and the network 140. Themanagement node 110 may be implemented with a server, a workstation, apersonal computer or the like. The remote network devices 120 a . . .120 n may be a variety of electronic devices such as printers, scanners,servers, workstations, personal computers, and the like.

[0025] The network 140 may be configured to provide a communication pathbetween the management node 110 and the remote network devices 120 a . .. 120 n. The network 140 may be implemented using network protocols suchas Ethernet, token ring, X.25, simple network management protocol(“SNMP”), etc.

[0026]FIG. 2 illustrates a detailed block diagram of an exemplaryembodiment of the management node 110. In particular, the managementnode 110 includes the NMS 130. As discussed above, the capabilities ofthe management node 110 to monitor, troubleshoot and diagnose thecomputer network 130 may be implemented utilizing the NMS 130. As partof the monitoring function of the NMS 130, the NMS 130 may be configuredto retrieve network attributes from remote devices (e.g., remote devices120 a . . . 120 n) or nodes through a network interface 220 of themanagement node 110. The network attributes may include data valuesrelated to one or more network attributes (e.g., status, transactionaldata, port data, address data, network performance parameters, and thelike) measured by a network device. The network attributes may becollected, stored and later analyzed by other network tools (orfunctions) to monitor and/or maintain the network 140.

[0027] The time-bucketing data collection module 230 may be configuredto retrieve network attributes from remote network devices and/or tocollate (or sort) the retrieved information into time interval bins (ortime-buckets) to assist in the maintenance of a network. For example,each time-bucket includes data values (e.g., measurement of a networkattribute) measured by remote devices 120 a . . . 120 n during apredetermined period of time, such as during a one hour time interval.It will be apparent to one of ordinary skill in the art that the lengthof the time-bucket is not limited to one hour and may be adjusted by anetwork administrator.

[0028] The time-bucketing data collection module 230 calculates abaseline value (e.g., a normal operating range for a network attribute)for a time-bucket using the sorted data values for the networkattributes. Then, the baseline value is recalculated for networkattributes corresponding to a subsequent time-bucket. Accordingly, thebaseline value is continuously recalculated for each time-bucket andnetwork attribute. Data values for a particular network attribute andtime-bucket received by the management node 110 are compared to acalculated baseline value for that time-bucket and that networkattribute. If the incoming information is outside the baseline value, analarm may be generated by an alarm module of the time-bucketing datacollection module 230.

[0029]FIG. 3 illustrates a more detailed block diagram of thetime-bucketing data collection module 230, shown in FIG. 2, according tothe principles of the present invention. As shown in FIG. 3, thetime-bucketing data collection module 230 may include a data collectormodule 310, a data warehouse 320, a time-bucket module 330, a thresholdcalculation module 340, a threshold comparator module 350, and an alertmodule 360.

[0030] The data collector module 310 of the time-bucketing datacollection module 230 may be configured to retrieve data values foruser-specified network attributes from remote network devices (e.g.,remote devices 120 a . . . 120 n) at scheduled intervals as described inU.S. patent application Ser. No. 09/704,730, entitled “System forSelf-Monitoring of SNMP Data Collection Process” (Attorney Docket No.10006665-1), herein incorporated by reference. The data collector module310 may be configured to retrieve the user-specified information (e.g.,data values for network attributes) by opening up a communicationchannel, e.g., a socket, for each remote network device and querying theremote network device through the network interface 220 of themanagement node 110.

[0031] The data warehouse 320 of the time-bucketing data collectionmodule 230 may be configured to provide storage and/or retrieval of datavalues retrieved from the remote network devices. The data warehouse 320may be implemented by a memory controller (not shown) and a randomaccess memory, flash memory, hard disk storage or the like.

[0032] Alternatively, the data warehouse 320 may be configured to storethe incoming information into memory blocks, where each memory blockrepresents a time-bucket/interval/bin. As the data values are retrieved,the memory controller may reference the time-bucket module 330 todetermine the appropriate time-bucket for an incoming data value.

[0033] The time-bucket module 330 of the time-bucketing data collectionmodule 230 may be configured to provide a user the capability to definebuckets, intervals or bins of time over a course of a week to sort thereceived information. A known trend in network traffic patterns is agiven network traffic pattern tends to occur at similar times andsimilar days. Thus, by providing the capability to set uptime-buckets/bins/intervals, information may be sorted or binnedaccording to the temporal occurrence of a given network traffic patternand stored in the data warehouse 320 by time-bucket. The sortedinformation may be utilized to provide a more accurate analysis of thestate of the network during the captured time because the analysis willinclude information of the given network traffic pattern. U.S. patentapplication Ser. No. 09/818,730, entitled System For Time-Bucketing OfBaselined Data Collector Data, herein incorporated by reference,discloses a user-defined time-bucket.

[0034] The threshold calculation module 340 of the time-bucket datacollection module 230 may be configured to calculate a baseline valuefor a monitored network attribute of the network 100. A technique forcalculating a baseline value is described in U.S. Pat. No. 6,182,022(Mayle et al.), herein incorporated by reference. For example, thethreshold calculation module 340 retrieves data values for a particularnetwork attribute N1 and a particular time-bucket T1 from the datawarehouse 320. The threshold calculation module 320 then performs astatistical analysis on the data values to generate a normal operatingrange for the network attribute N1 for that period of time (i.e., duringthe interval of the time-bucket T1). The statistical analysis mayinclude calculating a mean M1 of the network attribute N1 measuredduring the time-bucket T1, and calculating a normal operating range,such as plus or minus three standard deviations from the mean M1. Thebaseline value may include the calculated normal operating range or athreshold approximately equal to the mean M1 plus three standarddeviations. It will be apparent to one of ordinary skill in the art thatthe baseline value may be calculated using other statistical analysis orusing a different number of standard deviations.

[0035] The threshold calculation module 340 may also be configured tocalculate a rearm baseline value, which includes a range within thecalculated normal operating range of the baseline value (e.g., plus orminus one standard deviation from the mean M1) or a threshold below thethreshold of the baseline value. It will be apparent to one of ordinaryskill in the art that the rearm baseline value may be calculated usingother statistical analysis or using a different number of standarddeviations. The rearm baseline value is used to determine when to resetan alarm after an alarm is generated in response to a data value for anetwork attribute being outside a baseline value (e.g., being outside anormal operating range or exceeding a threshold). For example, if analarm is generated in response to one or more data values exceeding abaseline value, the alarm may not be regenerated if another data valueexceeds the baseline value. However, if one or more data values arereceived that do not exceed the rearm baseline value, the alarm is resetand may be generated again. The rearm baseline value may be a thresholdor a range. Accordingly, if one or more data values are received and arewithin the range of the baseline value or below the threshold of thebaseline value, the alarm is reset.

[0036] The threshold calculation module 340 may be configured toretrieve recently received data values for a network attribute from thedata warehouse 320 and recalculate baseline values and rearm baselinevalues for different time-buckets. The threshold comparator module 350may be configured to compare data values for the correspondingtime-bucket to the baseline value and rearm value if necessary. If thedata values exceed the baseline value, the threshold comparator module350 may notify the alert module 360.

[0037] The alert module 360 of the data collection module 230 may beconfigured to generate an alarm to the network management system 130 inresponse to a notification of a data value exceeding or being outsidethe range of the baseline value.

[0038]FIG. 4 illustrates a flow diagram of an exemplary method 400employing the principles of the present invention. In step 405, datavalues for a network attribute are collected. For example, the datacollector module 310 receives data values for a network attribute fromthe remote devices 120 a . . . 120 n via the network 100. In step 410,the data values are stored in the data warehouse 320. The time-bucketmodule 330 may parse the received data values by time bucket and/ornetwork attribute.

[0039] In step 415, the threshold calculation module 340 calculates abaseline value. For example, data values D1 are retrieved from the datawarehouse that are for a network attribute and that are in a time-bucketT1. Time-bucket T1, for example, may include a one hour period of timein which the data values D1 were measured by the remote network devices120 a . . . 120 n. A baseline value is calculated for the data valuesD1. As described above and for illustration purposes only, the baselinevalue may be calculated based on a statistical analysis, such as a meanplus three standard deviations for a threshold. If the baseline value isa range, the range may include the mean of D1 plus or minus threestandard deviations.

[0040] In step 420, the threshold calculation module 340 calculates arearm baseline value using the data values (e.g., data values D1) thatwere used to calculate the baseline value in step 415. As describedabove and for illustration purposes only, the rearm baseline value maybe the mean plus one standard deviation for a threshold or the mean plusor minus one deviation for a range. The baseline value and the rearmbaseline value for the time-bucket T1 may be stored in the datawarehouse 320.

[0041] In step 425, the threshold comparator module 350 compares thedata values (e.g., data values D1) to the calculated baseline value. Ifthe data values are outside the range of the calculated baseline valueor exceed a threshold of the calculated baseline value, then thethreshold comparator module 350 transmits an alarm event notificationsignal to the alert module 360. The alert module 360 generates an alarm(step 430) in response to receiving the alarm event notification signal.If the data values are within the range of the baseline value or do notexceed the threshold of the baseline value, then the baseline value isrecalculated for a next time-bucket (step 450). If at least one datavalue exceeds the baseline value in step 425, then an alarm is generatedin step 430. Alternatively, to minimize false alarms, more than one datavalue may be required to exceed the baseline value to generate an alarmand/or data values may be required to exceed the baseline value for apredetermined period of time to generate an alarm.

[0042] In step 435, the threshold comparator module 350 comparessubsequent data values (e.g., data values measured after D1) to therearm baseline value. The threshold comparator 350 may comparesubsequent data values to the rearm baseline value until a subsequentdata value is within a range of the rearm baseline value or below athreshold of the rearm baseline value (step 435). Then, the thresholdcomparator module 350 transmits an alarm reset signal to the alertmodule 360. The alert module 360 resets the alarm generated in step 430in response to receiving the alarm reset signal (step 440). Then, thebaseline value and rearm baseline value are calculated for the nexttime-bucket (step 450). The next time-bucket, for example, may includethe next time-bucket after time-bucket T1. Alternatively, the nexttime-bucket may include the next time-bucket after a subsequent datavalue that is used to reset an alarm.

[0043] If at least one data value does not exceed the rearm baselinevalue in step 435, then the alarm may be reset in step 440.Alternatively, to prevent an alarm from being reset when an alarm eventhas not ceased, more than one data value may be required to be withinthe rearm baseline value to reset the alarm and/or data values may berequired to be within the rearm baseline value for a predeterminedperiod of time to reset the alarm.

[0044] The method shown in FIG. 4 and described above can be performedby a computer program. The computer program can exist in a variety offorms both active and inactive. For example, the computer program canexist as software comprised of program instructions or statements insource code, object code, executable code or other formats; firmwareprogram(s); or hardware description language (HDL) files. Any of theabove can be embodied on a computer readable medium, which includestorage devices and signals, in compressed or uncompressed form.Exemplary computer readable storage devices include conventionalcomputer system RAM (random access memory), ROM (read only memory),EPROM (erasable, programmable ROM), EEPROM (electrically erasable,programmable ROM), and magnetic or optical disks or tapes. Exemplarycomputer readable signals, whether modulated using a carrier or not, aresignals that a computer system hosting or running the computer programcan be configured to access, including signals downloaded through theInternet or other networks. Concrete examples of the foregoing includedistribution of executable software program(s) of the computer programon a CD ROM or via Internet download. In a sense, the Internet itself,as an abstract entity, is a computer readable medium. The same is trueof computer networks in general.

[0045] While this invention has been described in conjunction with thespecific embodiments thereof, it is evident that many alternatives,modifications and variations will be apparent to those skilled in theart. There are changes that may be made without departing from thespirit and scope of the invention.

What is claimed is:
 1. A method of monitoring a plurality of attributesof a system, said method comprising steps of: receiving a firstplurality of data values for an attribute of said system; generating analarm in response to at least one data value of said first plurality ofdata values exceeding a first threshold for said attribute; andresetting said alarm in response to a data value not exceeding a secondthreshold for said attribute, said second threshold being within saidfirst threshold and said data value being measured after said at leastone data value of said first plurality of data values.
 2. The method ofclaim 1, further comprising steps of: calculating said first thresholdbased on said first plurality of data values, wherein said firstplurality of data values are measured during a first predeterminedperiod of time; and comparing said first plurality of data values tosaid first threshold.
 3. The method of claim 2, further comprising stepsof: recalculating said first threshold for said attribute based on asecond plurality of received data values measured during a secondpredetermined period of time, said second predetermined period of timebeing subsequent to said first period of time; comparing said secondplurality of data values for said attribute measured during said secondperiod of time to said recalculated first threshold; generating a secondalarm in response to at least one of said second plurality of datavalues exceeding said recalculated first threshold further in responseto performing said step of resetting said alarm.
 4. The method of claim3, wherein said first period of time and said second period of time areapproximately one hour time intervals.
 5. The method of claim 1, whereinsaid step of receiving said first plurality of data values furthercomprises: receiving said first plurality of data values from aplurality of network devices connected to said network; and storing saidreceived data values.
 6. The method of claim 1, where said step ofgenerating further comprises a step of generating said alarm in responseto a plurality of said first plurality of data values exceeding saidfirst threshold.
 7. The method of claim 6, wherein said step ofgenerating further comprises a step of generating said alarm in responseto said plurality of said first plurality of data values exceeding saidfirst threshold for a predetermined period of time.
 8. The method ofclaim 1, wherein said first threshold is defined by a firstpredetermined number of standard deviations from a mean and said secondthreshold is defined by a second number of standard deviations from saidmean.
 9. The method of claim 10, wherein said first threshold isapproximately three standard deviations from said mean and said secondthreshold is approximately one standard deviation from said mean. 10.The method of claim 1, wherein said first threshold is a first range andsaid second threshold is a second range.
 11. The method of claim 1,wherein said attribute is a network attribute.
 12. An apparatus operableto monitor a plurality of attributes of a system, said apparatuscomprising: a data collector configured to receive a first plurality ofdata values for an attribute of said system from a plurality of networkdevices via a network; a threshold calculator configured to calculate afirst threshold for said attribute and a second threshold for saidattribute from said first plurality of data values, said secondthreshold being within said first threshold; and a threshold comparatorconfigured to compare said first plurality of data values to said firstthreshold and generate an alarm signal in response to at least one ofsaid first plurality of data values exceeding said first threshold, saidthreshold comparator being further configured to generate a reset signalafter said alarm signal is generated in response to a data value notexceeding a second threshold for said attribute, said data value beingmeasured after said at least one data value of said first plurality ofdata values.
 13. The apparatus of claim 12, wherein said data collectoris configured to receive a second plurality of data values for saidattribute and said threshold calculator is configured to recalculatesaid first threshold for said attribute from said second plurality ofdata values.
 14. The apparatus of claim 13, wherein said first pluralityof data values are measured during a first predetermined period of timeand said second plurality of data values are measured during a secondpredetermined period of time.
 15. The apparatus of claim 12 furthercomprising an alert generator, said alert generator being configured togenerate an alarm associated with said attribute exceeding said firstthreshold in response to receiving said alert signal, and said alertgenerator being further configured to reset said alarm in response toreceiving said reset signal.
 16. The apparatus of claim 12 furthercomprising a data warehouse configured to store data values receivedfrom said plurality of network devices, said data values including atleast said first plurality of data values.
 17. The apparatus of claim 12further comprising a time bucketor configured to sort received datavalues by one or more of a time bucket and a attribute.
 18. A computerreadable medium on which is embedded a program, the program performing amethod of monitoring a plurality of attributes of a system, said methodcomprising steps of: receiving a first plurality of data values for anattribute of said system; generating an alarm in response to at leastone data value of said first plurality of data values exceeding a firstthreshold for said attribute; and resetting said alarm in response to adata value not exceeding a second threshold for said attribute, saidsecond threshold being within said first threshold and said data valuebeing measured after said at least one data value of said firstplurality of data values.
 19. The computer readable medium of claim 18,wherein said method further comprising steps of: calculating said firstthreshold based on said first plurality of data values, wherein saidfirst plurality of data values are measured during a first predeterminedperiod of time; and comparing said first plurality of data values tosaid first threshold.
 20. The computer readable medium of claim 19,wherein said method further comprising steps of: recalculating saidfirst threshold for said attribute based on a second plurality ofreceived data values measured during a second predetermined period oftime, subsequent said first period of time; comparing said secondplurality of data values for said attribute measured during said secondperiod of time to said recalculated first threshold; generating a secondalarm in response to at least one of said second plurality of datavalues exceeding said recalculated first threshold further in responseto performing said step of resetting said alarm.